A group of researchers from North-East and New York Universities have developed a technique to determine the approximate location of an SMS message recipient based on analyzing delays in SMS delivery. With an accuracy of up to 96%, the proposed method allows senders of SMS messages to determine the recipient’s country. Additionally, the technique can be used to determine if the recipient is abroad or to identify the places they typically frequent.
The experiment involved devices in the USA, United Arab Emirates, and seven European countries, with coverage of ten communication operators across various mobile networks such as LTE, LTE+, and 5G NSA. When attempting to determine a recipient within the country, the accuracy rate for separating two regions in Belgium was 86%, 68% in Germany, 79% in Greece, and 76% in the United Arab Emirates.
What makes this method interesting is that it doesn’t require access to the operator’s infrastructure level. Instead, it’s implemented on the side of a regular client and can be applied stealthily by sending “soundless” SMS that go unnoticed by the recipient. The information used to determine the location of the recipient is based on delivery delays, which are calculated based on the time between sending an SMS and receiving service notifications from the reference network, as well as delivery reports from the operator the recipient is currently using.
The researchers used a machine learning system to compare the delay and location, with the model being trained based on the measured delays for standard places relative to the current location of the sender. The code for the method and the machine learning model used by the researchers is available on GitHub.
It’s worth noting that the technique can be used in two stages. In the preparatory stage, the attacker periodically sends a series of silent SMS and measures the time it takes to receive the delivery notification. In the second stage, data on delivery delays are accumulated blindly, and the location is calculated based on a constructed machine learning model in a phased forecasting approach – starting with continuity, to the country, and eventually to the region.
Overall, the new technique offers a unique way of identifying the approximate location of SMS recipients without the need for access to operator infrastructure. However, given the potential privacy implications and the possibility of misuse, individuals should be cautious about sending SMS messages to unknown recipients.